The Cart66 Cloud plugin contains a publicly accessible phpinfo.php script that exposes sensitive server configuration and environment data. An attacker can retrieve this file without authentication, potentially revealing database credentials, server paths, and other confidential details. This flaw is classified as information disclosure (CWE‑200).

The vulnerability affects all installations of the Cart66 Cloud WordPress e‑commerce plugin with versions 2.3.7 or earlier. The plugin is distributed by reality66 and is commonly used to provide a convenient shopping experience within WordPress sites.

The CVSS base score is 5.3, indicating moderate impact. The EPSS score is <1%, suggesting exploitation is unlikely at present. The vulnerability is not listed in the CISA KEV catalog. The attack requires no authentication; a direct HTTP request to the plugin’s phpinfo.php file allows the attacker to read sensitive information. Administrators should be aware that any site exposing this script is susceptible to unauthenticated data leakage.